1. Board Governance | Board Audit
Ethical Boardroom | Winter Edition 2014
n the not well enough read
Accounting Historians Journal
inJune2001,GarySpraakman,
aProfessorfromYorkUniversity
in Toronto, perfectly defined
internal audit and in doing so
he - perhaps inadvertently - set
thefoundationstonesofwhatconstitutes
good internal audit oversight.
Spraakman’s article sought to examine and
challenge the history of internal audit. His
research led him to a 1957 paper on railway
auditing in the United Kingdom during the 19th
century. More specifically this paper looked at
the internal audit activities at the London and
North Western Railway in the 1860s.
The London and North Western Railway was
a British railway company that existed between
1846and1922.Inthelate19thcenturytheLondon
and North Western Railway was the largest joint
stock company - the modern equivalent being a
corporation or a limited company - in the world.
In a letter from the external auditors of
the London and North Western Railway to its
shareholders the external auditors noted:
That the main check, as between the Board and
its numerous servants, devolves of course on the
large establishment at Euston called the Audit
Office, headed by a responsible Officer … The
verification is therefore as between the Board and
the Shareholders – its object being to ensure that
the Books are kept upon correct principles, that the
published accounts are in accordance therewith,
and that they honestly lay bare to the proprietors
the true condition of the undertaking.
To honestly lay bare. To the proprietors. The
trueconditionoftheundertaking.Auditorsexist
to live out the meaning of these words.
To honestly lay bare - this mandates that the
auditor must provide their opinion without fear
or favour; devoid of bias.
To the proprietors - the key relationship that an
auditor has is with the organisation’s board for
theyaretheproxies,atleastinalargecorporation,
for the market participants that have invested in
the organisation.
I
The true condition of the undertaking - the
auditor needs to define the boundaries of their
examination and assess the undertaking based
on the evidence that they are able to examine.
Consequentlywhenoneistaskedwithoversight
over the internal audit function, a key
responsibility is to determine whether, indeed,
the function has honestly laid bare to the
proprietorsthetrueconditionoftheundertaking.
Before commencing assessing internal audit
oversight it is necessary to determine firstly
with whom does the responsibility lie. If the
London and North Western Railway mandate
holds true - as we believe that it does - then it
should be the agents of the board that are
tasked with the oversight responsibility.
Ensuring Consistency
In a well-structured organisation that board
oversight responsibility is usually delegated to
an audit committee.
Equally it is important to consider what
activitieswillbeconsideredwithintheboundaries
of the Board’s oversight. Unfortunately we have
seen many instances where an audit function is
being assessed against a definition of their work
Internal Audit
Oversight The importance of facilitating proper
oversight and direction of internal audit
Tom McLeod
Chief Audit Executive,
Owner at McLeod
Governance

2. Board Audit | Board Governance
Ethical Boardroom | Winter Edition 2014
with which they do not agree.
Soastoensureconsistencyofexpectationswe
havealwaysfounditwisetoplacerelianceonthe
International Professional Practices Framework
of the Institute of Internal Auditors (the IIA).The
IIA was established in 1941 and is the internal
audit profession’s global advocacy and key
educator.TheInternationalProfessionalPractices
Framework defines internal audit as “an
independent,objectiveassuranceandconsulting
activity designed to add value and improve an
organisation’s operations”.
TheFrameworknotesthat,donewell,internal
audit “helps an organisation accomplish its
objectives by bringing a systematic, disciplined
approach to evaluate and improve the
effectiveness of risk management, control and
governance processes”.
However internal audit is defined it needs to
be, and be seen to be, an important element in
the perpetual improvement of the organisation’s
internal control environment. If the internal
control environment is not improved by the
existence and operation of the internal audit
function one needs to ask whether - mandatory
requirements aside - the resourcing of an
of the Australia’s primary securities exchange
and the facilitator since 2003 of key corporate
governance principles upon which the activities
of those listed on the exchange are measured.
TheASXusestheIIAdefinitionofinternalaudit
to define its principal objective. The ASX charter
is prescriptive on the accountability and
responsibility of its internal audit function by
settingoutexpectationsonreportingdeliverables
such as:
■ Regularly advising on progress against the
internal audit plan and any significant matters
impacting achievement of the annual work
programme;
■ An annual fraud risk control assessment;
independent assurance mechanism is worth it.
It is within that definitional and value context
that that the IIA released an oversight checklist
that is considered the base level of what
constitutes adequate oversight of internal audit
by an Audit Committee.
Many of the observations regarding adequate
oversight are common sense. Alas too often in
organisations that view internal audit as an
optional expense such common sense is lacking.
The best examples of internal audit oversight
are those that find a way to review their
current station against the IIA guidelines –“The
auditcommitteeengagesinanopen,transparent
relationship with the chief audit executive
(the CAE)”.
Therelationshipbetweentheauditcommittee
and the CAE is of critical importance. Operating
well such a relationship will be mutually
beneficial. There will be guidance sought and
given in a fraternal and supportive way. It is an
environment where there is mutual trust and
respectfortherolesthatareplayedbyeachother.
When this relationship breaks down or is
fractured what one tends to see is the audit
committee placing conditional reliance on the
work of the internal audit function. Equally the
CAE may seek to withhold information from
theauditcommitteeorseekguidancefromothers
not as suited to provide independent counsel.
An open and transparent relationship is
demonstrated by regular formal and informal
communication. The audit committee reviews
andapprovestheinternalauditcharterannually
and the internal audit charter provides the
functional and organisational framework
within which the internal audit function
operates. This document sets out the scope and
objectives, authority and accountability and
role and responsibility of internal audit. In
terms of objectives many charters adopt the
IIA definition as the basis.
In reviewing internal audit charters we
encourage organisations to benchmark their
approach with other like or high profile
organisations.Wearepartialtotheinternalaudit
charter of the Australian Securities Exchange
(ASX)-thecompanytaskedwiththedevelopment
ONGOING PROJECT
When the organisation
changes so should the
internal audit plan
“Tohonestlylaybare
totheproprietors
thetrueconditionof
theundertaking”

3. Board Governance | Board Audit
Ethical Boardroom | Winter Edition 2014
Copyright © 2016 by Ethical Boardroom strictly reserved. No parts of this material
may be reproduced in any form without the written permission of Ethical Boardroom.
What matters is not the discipline that they have
studied at university but their ability to approach an
audit with a dispassionate yet inquiring mind
■ An annual assessment on the adequacy and
effectivenessoftheASX’sprocessesforcontrolling
its activities and managing risks;
■ Reportingonsignificantriskandcontrolissues
arising from the work of internal audit including
potential improvements to processes and
procedures;
■ Coordination with and provide oversight of
other control and monitoring functions (eg risk
management; compliance; security; legal and
external audit).
In annually reviewing an internal audit charter
theauditcommitteeshouldensurethattheintent
and execution of the charter remain consistent
and relevant to the board’s expectations of
internal audit’s strategy and objectives.
Equally the audit committee should have
in place a protocol as to who is empowered to
approve an amendment to the internal audit
charter. Bestpracticewoulddictatethatitwould
be the audit committee itself and possibly the
Chief Executive Officer.
As a result of discussions with the CAE, the
audit committee has a clear understanding of
thestrengthsandweaknessesoftheorganisation’s
internal control and risk management systems.
Aswenotedabove,theinternalauditfunction
exists to ensure the perpetual improvement of
the organisation’s internal control environment.
Consistent with this therefore is that the
CAE must properly and well articulate the true
condition of the undertaking that it is reviewing.
If it fails to do so or deliberately seeks
communicate in an ambiguous manner not only
will the Audit Committee be devoid of proper
knowledgeofthecurrentenvironmentoverwhich
it seeks to govern but it will become lack the
ability to properly supervise the management
thatshouldbeaddressinganycontroldeficiency.
Theissueastowhetheraninternalauditfunction
should articulate both the strengths and the
weaknessesoftheorganisationhasbeendebated
strongly within the internal audit community.
Is it the role of internal audit to offer praise on
the well operated processes and procedures of
the area that it has sought to review? Or should
internal audit only concern itself with where
there are opportunities for improvement? This
isadebatethateachorganisationneedstodecide.
Irrespective of those deliberations, however,
it is incumbent upon both the audit committee
and the CAE that that the current state of the
internal control and risk management systems
arewellarticulatedinamannerthatisnotdense
on detail nor so high level that key messages are
lost in translation.
The internal audit activity is sufficiently
resourced with competent, objective internal
auditprofessionalstocarryouttheinternalaudit
plan which has been reviewed and approved by
the audit committee.
What Makes A Good Auditor
Indeterminingwhethertheinternalauditactivity
is sufficiently resourced with competent and
objective professionals one needs to first define
- and document - what it is that demonstrate
competency and objectivity.
Itwouldbeerroneoustothinkthataninternal
audit professional must be someone that has
been born to the profession. Some of the best
internal audit professionals that we have had
the pleasure to work with are those that come
from varied backgrounds such as psychology
and, even, zoology.
What matters is not the discipline that they
have studied at university but their ability to
approach an audit with a dispassionate yet
inquiring mind; to be able to articulate well yet
not verbosely.
Indeed to suggest that someone needs to
have had advanced studies to be an internal
audit professional is equally erroneous. It is
that person’s ability to demonstrate the
characteristics previously mentioned that is of
greatest importance.
The second element here is that there needs to
beaninternalauditplan. Thatistheinternalaudit
functionneedstobemethodicalintheassessment
ofwhichareasthatitconsiders-usuallydictated
by a risk rating - worthy of its attention.
A trap that immature internal audit functions
sometimes falls into is that they consider that
the internal audit plan - once approved - cannot
bechanged. Anorganisationisalivingbeastand
soisaninternalauditplan-whentheorganisation
changes so should the internal audit plan.
A strong audit committee will acknowledge
this and will facilitate regular reviews of the
ongoing relevance of the internal audit plan.
The internal audit activity is empowered to be
independent by its appropriate reporting
relationships to executive management and the
audit committee.
The audit committee address with the CAE
all issues related to internal audit independence
and objectivity. Without independence you do
not have an effective internal audit function.
Internal audit must be, and must be seen to
be, independent of the activities and processes
that it appraises so as to ensure that it is capable
of performing its duties in an objective manner
and providing impartial advice to management
and the Board.
The independence is best demonstrated by a
director reporting line between the CAE and
the audit committee in terms of functional
audit matters. Many organisations additionally
arrangethattheCAEreportstoaseniorfunction
for administrative purposes. Best practice is
that,foradministrativepurposes,theCAEreports
to the Chief Executive Officer. Additionally the
IIA considers it important that:
■ Theinternalauditactivityisqualityorientated
and has in place a Quality Assurance and
Improvement Program.
■ ThatAuditcommitteeregularlycommunicates
with the CAE about the performance and
improvement of the CAE and the internal audit
activity.
■ Internalauditreportsareactionable,andaudit
recommendations and / or other improvements
are satisfactorily implemented by management.
■ ThatAuditcommitteemeetsperiodicallywith
the CA without the presence of management.
Failingtoproperlyoversightafunctionthatseeks
to honestly lay bare the true condition of the
undertakingopensupthosethatseektosupervise
and govern organisations that they are not doing
all that they can to properly inform - and grow
the wealth - of the proprietors.
What is it that you - as the proprietor or as a
proxyfortheproprietor-aredoingtoensurethat
your internal audit function is worthy of its
ancestral roots?
iNTERNAL AUDIT FUNCTION
It exists to ensure the perpetual
improvement of an organisation’s
internal control environment